Wednesday, 28 February 2018

ICO response - Police will retain my details for six years

Once more we return to the subject of the Police Information Notice, or 'harassment warning' issued to me by Dyfed Powys police in August 2016 in relation to this blog. The complainant was council chief executive Mr Mark James. This blog has recorded the details of the complaints, the police investigations and their decision to charge following his second complaint. It has also recorded the CPS decision to drop the case in July last year and my unsuccessful efforts, throughout, to have the PIN removed, and subsequently, to have my details removed from police systems.

This eventually evolved into a Data Protection issue and led me to appeal to the Information Commissioner that Dyfed Powys Police were retaining information about me, on their records, longer than was necessary. As you can see from the letter below, this was also unsuccessful.

A PIN is essentially a letter warning that your actions (in this case writing a blog about the council), if repeated, could amount to harassment. It stays 'live' for 14 months before it is reviewed. There is no avenue to defend oneself against the allegations made by the complainant and the only options available are to ask the chief constable to remove it or a judicial review - it is a verdict without trial. The chief constable refused and a judicial review carried a cost risk and would have required specialist legal representation. I understand that some police forces have now scrapped the use of PINs altogether, but not Dyfed Powys.

Mr James' second complaint led to threats of arrest, police questioning and a summons to court. At the last minute the CPS decided to discontinue the case stating that the comments were not oppressive, did not amount to a 'course of conduct' and as a public figure, Mr James should expect to receive some criticism. This second raft of complaints included, bizarrely, publications by Private Eye, the Carmarthenshire Herald, and representations made by Assembly Member Adam Price. As I mentioned, further details of the allegations can be found by searching the blog, most recently here.

Another concern I raised with the police was that, in 2014 when Mr James was under criminal investigation over the pension and libel indemnity scandals Dyfed Powys felt that a conflict of interest arose due to their 'close working relationship' and passed the case over to Gloucestershire police. Strangely, they denied that there was any conflict of interest when acting on behalf of Mr James against me.

The retention of information in not the same as a criminal record but is, in effect, a marker and has a similar effect - despite not being convicted of any crime nor having had a legal right to defend myself against the PIN. Though I can only assume that Mr James' details are similarly held on the records of Gloucestershire police after the 2014 investigation for misconduct in public'd be strange if they weren't, wouldn't it?

Anyway, I will be making enquiries as to how, or if, I can take this further.


Teifion said...

I hope the senior officers in Dyfed Powys police their actions in this case (and the Pembs. "grants scandal") seriously undermine the public trust in the police services as a whole - great sadness, Lions lead by Donkeys

Anonymous said...

6 Years, it'll probably be on there forever..

John Brace said...

Well when the General Data Protection Regulation comes into force on the 25th May 2018 (which is less than three months away), will that change the situation then?

There's plenty of information various police forces hold that is factually inaccurate on people, but the police force seem more concerned with repeating the factual inaccuracies than actually correcting it!

About the only way I can think of that DPP would change their stance is if you got a court order, as ICO seem pretty toothless when it comes to data protection (unless it's really serious breaches that attract a fine). ICO's response to public sector organisations with their response usually being they'll write a letter/email, then take at completely face value whatever response they receive back from the public sector organisation.

Mind you the police forces ignored the High Court ruling on retention of custody images and DNA of those found innocent, so I wonder if the police see themselves as somehow above the law (which is worrying)!

caebrwyn said...

I also suspect my information will be kept indefinitely and would likely take a court order to remove it. The new GDPR may strengthen the right to erasure of information, I'm not sure, maybe I'll try again in June and we'll find out...
The remit of the ICO is to check that the police have complied with the force's own retention rules not to make a judgement on whether those rules should have been deployed in the first place, that is down to the police. I have no idea what the police told the ICO but the letter reads as if I've actually been convicted of a criminal offence.

John Brace said...

The below is not meant as legal advice but merely commentary based on past experience.

To be honest, I've only ever got a county court order to enforce a subject access request (section 7 of the DPA '98) rather than rectification, blocking, erasure and destruction (section 14 of the DPA '98). That unfortunately took around 8 months in the local county court in part due to the fact two defendants were involved. That was way back in 2011 & 2012 though, so I'm sure things have changed since then.

It went to a hearing (eventually), where the councillor involved (one of the defendants) gave a bunch of political answers in response to District Judge Ireland which didn't seem to please her one bit.

She then asked him to just give yes and no answers to her questions.

It's the first time I've seen a Judge use her mobile phone to read the relevant law during a case though.

Nice to see a Judge bothering to read what the law says before making a decision (which isn't always the case).

I suppose Data Protection Act cases are rather rare.

At an earlier unopposed hearing in the same matter because at the time I was also seeking a court order and damages, I got compared to Kate Moss by a different Judge.

I got asked at the end of the final hearing if I wanted costs awarded against the defendants to which I answered no. Let's face it it was just a bit of paperwork involved and the state paid the court fees!

The police AFAIK can unfortunately ignore most subject access requests and the first data protection principle if it's personal data to do with "the prevention or detection of crime" or "the apprehension or prosecution of offenders".

There have been a few legal cases brought by against the police (with regards to retention of data) by people later found innocent of the crimes they were accused of.

If I remember correctly, if I remember what I read in those cases the arguments put forward by the police was:-

a) although you may be innocent now we need to keep the information on file in case the person involved may commit a crime in the future, also keeping the information may also help us to prove someone's innocence too. For example if a person was in police custody at a time they were being accused of a crime elsewhere.

b) there were rather long and complex legal arguments about the legal position with regards to UK and EU law in this area that are beyond the scope of this comment to go into at this point.

In the end if I remember correctly, a number of linked cases were heard together and the judiciary sided with the police. Can't remember the case reference number or party names off the top of my head though but it was probably at the Court of Appeal level.

caebrwyn said...

Thanks for sharing this info John, very interesting. I'll be keeping my options open. I last made Subject Access requests in 2016, to the police and the council, and although I didn't take it further at the time (being preoccupied with other things) there was a questionable blanket use of legal privilege to exclude most of the information.

John Brace said...

In the court case I mentioned, some of what I'd asked for in the subject access request has been refused on those grounds too in a blanket way to exclude some of the information.

The Judge (who presumably got to see what I didn't) upheld that part of the response to part of the subject access request, but not to the rest which it transpired the people involved had been told not to share with me. Hence why the subject access request hadn't been complied with within the 40 day limit or in response to the case.